Product wants to add a recommendation feature using browsing history. Legal asks for a data protection impact assessment. What does architecture need to supply?

What the assessment actually needs from architecture

Legal cannot assess a feature description. They need the data facts, which only the design supplies:

A data flow diagram with each flow labelled by the fields it carries — not the protocol. Which systems receive browsing history, in what form, how often, and where each of them processes.

Necessity and proportionality evidence. What is the minimum data that achieves the outcome? If the recommendation works on category-level interest rather than full URL history, that is a materially different assessment and it is an architectural choice.

Retention. How long is the history kept, and what happens at the end.

Access. Who and what can read it, and under what purpose.

Third parties. Any processor involved, where they process, and their sub-processors.

The design choices that change the outcome

These are worth putting in front of legal as options rather than presenting one design:

• Aggregate rather than store raw. Derive interest categories on ingest and discard the URL history. Much lower risk, usually a small accuracy cost.
• On-device inference, where the profile never leaves the client. Strongest position and it constrains the model.
• Short retention with rolling windows rather than indefinite history.
• Pseudonymisation at rest, with the mapping separately controlled — noting that this reduces risk and does not remove the data from scope.

Presenting the trade explicitly — accuracy against exposure — gets a better decision than presenting the maximal design and defending it.

The obligations that follow and become requirements

Whatever is agreed, some of these will apply and each is a design constraint rather than documentation: a lawful basis, and if it is consent then granular, versioned and withdrawable with propagation to every consumer; the ability to include this data in a subject access response; erasure within the statutory period, across every derived copy; and an objection mechanism that actually stops the processing.

The timing point

Do this before the design is fixed. A recommendation feature designed around full history and then assessed is either rebuilt or shipped with an uncomfortable assessment. The same feature designed after the assessment is usually simpler and cheaper.